Operation error STS: GetCallerIdentity issue with Unit Tests issue with Region about aws-privateca-issuer HOT 4 CLOSED

This is a known issue that we currently have with the issuer plugin. There are two things you'll need to do to fix this issue

1. Checkout the cleanup branch (see this PR: #53)
   git fetch -a
git checkout cleanup

2. We recommend using an IAM User with the plugin currently. See instructions here: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html#Using_CreateAccessKey. Your IAM User will need to have at minimum permissions listed here: https://github.com/cert-manager/aws-privateca-issuer#configuration
   export AWS_SECRET_ACCESS_KEY=<Secret Access Key you generated>
export AWS_ACCESS_KEY_ID=<Access Key you generated>

After doing these two steps, I was able to run the local tests after recreating your issue. Please let us know if you are successful!

Edit: You may want to run kind delete cluster pca-external-issuer before you test just so you’re running a fresh run as well

from aws-privateca-issuer.

Thank you for raising this issue with the AWS Private CA Issue plugin. We have reviewed your submission and replicated the issue you raised. The issue has been prioritized with our support and engineering teams. We will reach out to you if we have additional questions and will provide a notification when the issue is resolved.

from aws-privateca-issuer.

Interesting!

I fixed the issue by patching the manager pod with deploy-patch.yaml

spec:
  template:
     spec:
        containers:
          - name: manager
             env:
             - name: AWS_REGION
                value: "us-east-1"

kubectl patch deploy aws-privateca-issuer-controller-manager -n aws-privateca-issuer-system --patch "$(cat deploy-patch.yaml)"

.PHONY: deploy-cert-manager
deploy-cert-manager: ## Deploy cert-manager in the configured Kubernetes cluster in ~/.kube/config
	kubectl apply --filename=https://github.com/jetstack/cert-manager/releases/download/v${CERT_MANAGER_VERSION}/cert-manager.yaml
	kubectl wait --for=condition=Available --timeout=300s apiservice v1.cert-manager.io
	kubectl patch deploy aws-privateca-issuer-controller-manager -n aws-privateca-issuer-system --patch "$(patch-deploy.yaml)"

and updated the Makefile to use this patch until you all merge that in.

Let me try your fix by rebasing the open PR you referenced.

from aws-privateca-issuer.

Looks good after applying patch above. I see now where it adds the Region to the spec.

from aws-privateca-issuer.